/******************************************************************/
/*                                                                */
/*  Winpooch : Windows Watchdog                                   */
/*  Copyright (C) 2004-2007  Benoit Blanchon                      */
/*                                                                */
/*  This program is free software; you can redistribute it        */
/*  and/or modify it under the terms of the GNU General Public    */
/*  License as published by the Free Software Foundation; either  */
/*  version 2 of the License, or (at your option) any later       */
/*  version.                                                      */
/*                                                                */
/*  This program is distributed in the hope that it will be       */
/*  useful, but WITHOUT ANY WARRANTY; without even the implied    */
/*  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR       */
/*  PURPOSE.  See the GNU General Public License for more         */
/*  details.                                                      */
/*                                                                */
/*  You should have received a copy of the GNU General Public     */
/*  License along with this program; if not, write to the Free    */
/*  Software Foundation, Inc.,                                    */
/*  675 Mass Ave, Cambridge, MA 02139, USA.                       */
/*                                                                */
/******************************************************************/

#ifndef _UNDOC_VISTA_H
#define _UNDOC_VISTA_H


typedef struct _MMADDRESS_NODE
{
  /* +0x000 */ UINT	u1 ;
  /* +0x004 */ struct _MMADDRESS_NODE * LeftChild ;
  /* +0x008 */ struct _MMADDRESS_NODE * RightChild ;  
  /* +0x00c */ UINT	StartingVpn ;
  /* +0x010 */ UINT	EndingVpn ;  
} MMADDRESS_NODE, *PMMADDRESS_NODE ;

typedef struct _MM_AVL_TABLE
{
  /* +0x000 */ MMADDRESS_NODE	BalancedRoot ;
  /* +0x014 */ UINT		DepthOfTree : 5 ;
  /* +0x014 */ UINT             Unused : 3 ;
  /* +0x014 */ UINT		NumberGenericTableElements : 24 ;
  /* +0x018 */ PVOID	NodeHint ;
  /* +0x01c */ PVOID	NodeFreeHint ;
} MM_AVL_TABLE, *PMM_AVL_TABLE ;

typedef struct _ALPC_PROCESS_CONTEXT
{
  /* +0x000 */ EX_PUSH_LOCK	Lock ;
  /* +0x004 */ LIST_ENTRY	ViewListHead ;
  /* +0x00c */ UINT		PagedPoolQuotaCache ;
} ALPC_PROCESS_CONTEXT, *PALPC_PROCESS_CONTEXT ;

typedef struct _KPROCESS_VISTA
{
  /* +0x000 */ DISPATCHER_HEADER	Header ;
  /* +0x010 */ LIST_ENTRY	ProfileListHead ;
  /* +0x018 */ ULONG	DirectoryTableBase ;
  /* +0x01c */ ULONG	Unused0 ;
  /* +0x020 */ KGDTENTRY	LdtDescriptor ;
  /* +0x028 */ KIDTENTRY	Int21Descriptor ;
  /* +0x030 */ USHORT	IopmOffset ;
  /* +0x032 */ UCHAR	Iopl ;
  /* +0x033 */ UCHAR	Unused ;
  /* +0x034 */ ULONG	ActiveProcessors ;
  /* +0x038 */ ULONG	KernelTime ;
  /* +0x03c */ ULONG	UserTime ;
  /* +0x040 */ LIST_ENTRY	ReadyListHead ;
  /* +0x048 */ SINGLE_LIST_ENTRY	SwapListEntry ;
  /* +0x04c */ PVOID	VdmTrapcHandler ;
  /* +0x050 */ LIST_ENTRY	ThreadListHead ;
  /* +0x058 */ ULONG	ProcessLock ;
  /* +0x05c */ ULONG	Affinity ;
  /*    +0x060 AutoAlignment    : Pos 0, 1 Bit */
  /*    +0x060 DisableBoost     : Pos 1, 1 Bit */
  /*    +0x060 DisableQuantum   : Pos 2, 1 Bit */
  /*    +0x060 ReservedFlags    : Pos 3, 29 Bits */
  /* +0x060 */ LONG	ProcessFlags ;
  /* +0x064 */ CHAR	BasePriority ;
  /* +0x065 */ CHAR	QuantumReset ;
  /* +0x066 */ UCHAR	State ;
  /* +0x067 */ UCHAR	ThreadSeed ;
  /* +0x068 */ UCHAR	PowerState ;
  /* +0x069 */ UCHAR	IdealNode ;
  /* +0x06a */ UCHAR	Visited ;
  /* +0x06b */ UCHAR	ExecuteOptions ;
  /* +0x06c */ ULONG	StackCount ;
  /* +0x070 */ LIST_ENTRY	ProcessListEntry ;
  /* +0x078 */ ULONGLONG	CycleTime ;
} KPROCESS_VISTA, *PKPROCESS_VISTA ;


typedef struct _EPROCESS_VISTA
{
  /* +0x000 */ KPROCESS_VISTA	Pcb ;
  /* +0x080 */ EX_PUSH_LOCK	ProcessLock ;
  /* +0x088 */ LARGE_INTEGER	CreateTime ;
  /* +0x090 */ LARGE_INTEGER	ExitTime ;
  /* +0x098 */ EX_RUNDOWN_REF	RundownProtect ;
  /* +0x09c */ PVOID	UniqueProcessId ;
  /* +0x0a0 */ LIST_ENTRY	ActiveProcessLinks ;
  /* +0x0a8 */ ULONG	QuotaUsage[3] ;
  /* +0x0b4 */ ULONG	QuotaPeak[3] ;
  /* +0x0c0 */ ULONG	CommitCHARge ;
  /* +0x0c4 */ ULONG	PeakVirtualSize ;
  /* +0x0c8 */ ULONG	VirtualSize ;
  /* +0x0cc */ LIST_ENTRY	SessionProcessLinks ;
  /* +0x0d4 */ PVOID	DebugPort ;
  union {
    /* +0x0d8 */ PVOID	ExceptionPortData ;
    /* +0x0d8 */ ULONG	ExceptionPortValue ;
    /*    +0x0d8 ExceptionPortState : Pos 0, 3 Bits */
  } ;
  /* +0x0dc */ HANDLE_TABLE*	ObjectTable ;
  /* +0x0e0 */ EX_FAST_REF	Token ;
  /* +0x0e4 */ ULONG	WorkingSetPage ;
  /* +0x0e8 */ EX_PUSH_LOCK	AddressCreationLock ;
  /* +0x0ec */ struct ETHREAD_VISTA*	RotateInProgress ;
  /* +0x0f0 */ struct ETHREAD_VISTA*	ForkInProgress ;
  /* +0x0f4 */ ULONG	HardwareTrigger ;
  /* +0x0f8 */ MM_AVL_TABLE*	PhysicalVadRoot ;
  /* +0x0fc */ PVOID	CloneRoot ;
  /* +0x100 */ ULONG	NumberOfPrivatePages ;
  /* +0x104 */ ULONG	NumberOfLockedPages ;
  /* +0x108 */ PVOID	Win32Process ;
  /* +0x10c */ EJOB*	Job ;
  /* +0x110 */ PVOID	SectionObject ;
  /* +0x114 */ PVOID	SectionBaseAddress ;
  /* +0x118 */ PVOID	QuotaBlock ;
  /* +0x11c */ PVOID	WorkingSetWatch ;
  /* +0x120 */ PVOID	Win32WindowStation ;
  /* +0x124 */ PVOID	InheritedFromUniqueProcessId ;
  /* +0x128 */ PVOID	LdtInformation ;
  /* +0x12c */ PVOID	VadFreeHint ;
  /* +0x130 */ PVOID	VdmObjects ;
  /* +0x134 */ PVOID	DeviceMap ;
  /* +0x138 */ PVOID	EtwDataSource ;
  /* +0x13c */ PVOID	FreeTebHint ;
  /* +0x140 */ ULONGLONG	PageDirectoryPte ;
  /* +0x148 */ PVOID	Session ;
  /* +0x14c */ UCHAR	ImageFileName[16] ;
  /* +0x15c */ LIST_ENTRY	JobLinks ;
  /* +0x164 */ PVOID	LockedPagesList ;
  /* +0x168 */ LIST_ENTRY	ThreadListHead ;
  /* +0x170 */ PVOID	SecurityPort ;
  /* +0x174 */ PVOID	PaeTop ;
  /* +0x178 */ ULONG	ActiveThreads ;
  /* +0x17c */ ULONG	ImagePathHash ;
  /* +0x180 */ ULONG	DefaultHardErrorProcessing ;
  /* +0x184 */ LONG	LastThreadExitStatus ;
  /* +0x188 */ PEB*	Peb ;
  /* +0x18c */ EX_FAST_REF	PrefetchTrace ;
  /* +0x190 */ LARGE_INTEGER	ReadOperationCount ;
  /* +0x198 */ LARGE_INTEGER	WriteOperationCount ;
  /* +0x1a0 */ LARGE_INTEGER	OtherOperationCount ;
  /* +0x1a8 */ LARGE_INTEGER	ReadTransferCount ;
  /* +0x1b0 */ LARGE_INTEGER	WriteTransferCount ;
  /* +0x1b8 */ LARGE_INTEGER	OtherTransferCount ;
  /* +0x1c0 */ ULONG	CommitCHARgeLimit ;
  /* +0x1c4 */ ULONG	CommitCHARgePeak ;
  /* +0x1c8 */ PVOID	AweInfo ;
  /* +0x1cc */ SE_AUDIT_PROCESS_CREATION_INFO	SeAuditProcessCreationInfo ;
  /* +0x1d0 */ MMSUPPORT	Vm ;
  /* +0x218 */ LIST_ENTRY	MmProcessLinks ;
  /* +0x220 */ ULONG	ModifiedPageCount ;
  /* +0x224 */ ULONG	Flags2 ;
  /*    +0x224 JobNotReallyActive : Pos 0, 1 Bit */
  /*    +0x224 AccountingFolded : Pos 1, 1 Bit */
  /*    +0x224 NewProcessReported : Pos 2, 1 Bit */
  /*    +0x224 ExitProcessReported : Pos 3, 1 Bit */
  /*    +0x224 ReportCommitChanges : Pos 4, 1 Bit */
  /*    +0x224 LastReportMemory : Pos 5, 1 Bit */
  /*    +0x224 ReportPhysicalPageChanges : Pos 6, 1 Bit */
  /*    +0x224 HandleTableRundown : Pos 7, 1 Bit */
  /*    +0x224 NeedsHandleRundown : Pos 8, 1 Bit */
  /*    +0x224 RefTraceEnabled  : Pos 9, 1 Bit */
  /*    +0x224 NumaAware        : Pos 10, 1 Bit */
  /*    +0x224 ProtectedProcess : Pos 11, 1 Bit */
  /*    +0x224 DefaultPagePriority : Pos 12, 3 Bits */
  /*    +0x224 PrimaryTokenFrozen : Pos 15, 1 Bit */
  /*    +0x224 ProcessVerifierTarget : Pos 16, 1 Bit */
  /*    +0x224 StackRandomizationDisabled : Pos 17, 1 Bit */
  /* +0x228 */ ULONG	Flags ;
  /*    +0x228 CreateReported   : Pos 0, 1 Bit */
  /*    +0x228 NoDebugInherit   : Pos 1, 1 Bit */
  /*    +0x228 ProcessExiting   : Pos 2, 1 Bit */
  /*    +0x228 ProcessDelete    : Pos 3, 1 Bit */
  /*    +0x228 Wow64SplitPages  : Pos 4, 1 Bit */
  /*    +0x228 VmDeleted        : Pos 5, 1 Bit */
  /*    +0x228 OutswapEnabled   : Pos 6, 1 Bit */
  /*    +0x228 Outswapped       : Pos 7, 1 Bit */
  /*    +0x228 ForkFailed       : Pos 8, 1 Bit */
  /*    +0x228 Wow64VaSpace4Gb  : Pos 9, 1 Bit */
  /*    +0x228 AddressSpaceInitialized : Pos 10, 2 Bits */
  /*    +0x228 SetTimerResolution : Pos 12, 1 Bit */
  /*    +0x228 BreakOnTermination : Pos 13, 1 Bit */
  /*    +0x228 DeprioritizeViews : Pos 14, 1 Bit */
  /*    +0x228 WriteWatch       : Pos 15, 1 Bit */
  /*    +0x228 ProcessInSession : Pos 16, 1 Bit */
  /*    +0x228 OverrideAddressSpace : Pos 17, 1 Bit */
  /*    +0x228 HasAddressSpace  : Pos 18, 1 Bit */
  /*    +0x228 LaunchPrefetched : Pos 19, 1 Bit */
  /*    +0x228 InjectInpageErrors : Pos 20, 1 Bit */
  /*    +0x228 VmTopDown        : Pos 21, 1 Bit */
  /*    +0x228 ImageNotifyDone  : Pos 22, 1 Bit */
  /*    +0x228 PdeUpdateNeeded  : Pos 23, 1 Bit */
  /*    +0x228 VdmAllowed       : Pos 24, 1 Bit */
  /*    +0x228 SmapAllowed      : Pos 25, 1 Bit */
  /*    +0x228 ProcessInserted  : Pos 26, 1 Bit */
  /*    +0x228 DefaultIoPriority : Pos 27, 3 Bits */
  /*    +0x228 SparePsFlags1    : Pos 30, 2 Bits */
  /* +0x22c */ LONG	ExitStatus ;
  /* +0x230 */ USHORT	Spare7 ;
  /* +0x232 */ UCHAR	SubSystemMinorVersion ;
  /* +0x233 */ UCHAR	SubSystemMajorVersion ;
  /* +0x234 */ UCHAR	PriorityClass ;
  UCHAR a[3] ;
  /* +0x238 */ MM_AVL_TABLE	VadRoot ;
  /* +0x258 */ ULONG	Cookie ;
  /* +0x25c */ ALPC_PROCESS_CONTEXT	AlpcContext ;
} EPROCESS_VISTA, *PEPROCESS_VISTA ;

#endif
